Download as PDF (version 1.2) · Download all three policies (.zip)

This agreement sets out how Absolute Education LTD processes pupil and staff data on behalf of a school under UK GDPR Article 28. It forms part of, and takes priority over, the Terms of Service on any data protection matter.

1. Parties and background

The Controller: Demo Academy, 1 Example Road, Taunton, Somerset, TA1 1AA (“the School”).

The Processor: Absolute Education LTD, 40 Greenway Avenue, Taunton, Somerset, TA2 6HY. Company number 15413409. ICO registration number ZB757620 (“Absolute Education”).

1. The School subscribes to the Absolute Education Enrichment Tracker (“the Service”) to record, monitor and report on pupil participation in enrichment activities.
2. To provide the Service, Absolute Education processes personal data for which the School is the controller.
3. Both parties want that processing to meet the UK GDPR and the Data Protection Act 2018, and agree the terms below.

2. Definitions

Terms such as controller, processor, personal data, processing, data subject, personal data breach and special category data have the meanings given in the UK GDPR.

• Data Protection Law: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any guidance or code issued by the ICO, as updated from time to time.
• School Data: the personal data described in Schedule 1 that the School, its staff or an authorised integration (such as Wonde) submits to the Service.
• Sub-processor: any third party Absolute Education engages to process School Data.

3. Roles of the parties

1. Pupil data: the School is the controller and Absolute Education is the processor.
2. Staff user accounts: Absolute Education is the controller of staff account details (title, first name, surname, email address, job role) used to run accounts, provide support and send service communications. This is covered by the Absolute Education Privacy Notice, not by this agreement.
3. The School confirms that:
   1. it has a lawful basis under Data Protection Law to share School Data with Absolute Education (for most schools, public task under Article 6(1)(e));
   2. it has an Article 9 condition for any special category data it chooses to record, such as SEN status, ethnicity, dietary needs or medical conditions;
   3. its own privacy notice to pupils and parents tells them their data is processed by an enrichment tracking provider;
   4. its instructions to Absolute Education comply with Data Protection Law.
4. Instructions: the School’s documented instructions are this agreement, the Terms of Service, and the School’s use of the Service’s settings and features. Further written instructions may be given by email to info@absolute-education.co.uk.

4. Absolute Education’s obligations

Absolute Education will:

1. process School Data only on the School’s documented instructions, and tell the School promptly if it believes an instruction breaks Data Protection Law;
2. never sell School Data, use it for marketing, or share it with any third party except the sub-processors in Schedule 2;
3. ensure every person with access to School Data is bound by a duty of confidentiality, is trained in data protection, and has access only where needed to support, maintain or improve the Service;
4. apply the technical and organisational security measures in Schedule 3, and review them at least annually;
5. store and process School Data in the United Kingdom, and not transfer it outside the UK without the School’s prior written consent and appropriate safeguards under Data Protection Law. Service emails are not used to send School Data: scheduled reports are sent as a link, and staff sign in to download them;
6. keep a record of processing activities as required by Article 30(2) UK GDPR;
7. make available all information reasonably needed to show compliance with this agreement (see section 7).

5. Sub-processors

1. The School gives general authorisation for Absolute Education to use the sub-processors listed in Schedule 2.
2. Absolute Education will give the School at least 30 days’ notice by email before adding or replacing a sub-processor. The School may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the School may end its subscription and receive a pro-rata refund of fees for the unused period. Where a sub-processor must be replaced urgently, because it has stopped providing its service or to keep the Service running or secure, Absolute Education may make the change without that notice, and will tell the School by email as soon as reasonably possible; the School then has the same right to object.
3. Absolute Education will put a written contract in place with each sub-processor imposing data protection obligations no less protective than this agreement.
4. Absolute Education remains fully liable to the School for the acts and omissions of its sub-processors.

6. Rights requests, breaches and DPIAs

Rights requests

1. If Absolute Education receives a request from a pupil, parent or other data subject about School Data, it will pass it to the School within 3 working days and will not respond directly unless the School instructs it to.
2. Absolute Education will help the School respond to rights requests (access, rectification, erasure, restriction, objection) within the School’s one-month legal deadline, including by providing exports of the relevant data within 5 working days of a request.

Personal data breaches

3. Absolute Education will notify the School without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach affecting School Data.
4. The notice will describe, as far as known: what happened, the categories and approximate number of pupils and records affected, likely consequences, and the steps taken or proposed. Further detail will follow as it becomes available.
5. Absolute Education will co-operate with the School’s investigation and will not notify the ICO, pupils or parents about a breach of School Data without the School’s agreement, unless the law requires it.

DPIAs and regulators

6. Absolute Education will provide reasonable help, at no extra cost, with any data protection impact assessment the School carries out about the Service, and with any consultation with the ICO. Given the Service can hold SEN, ethnicity, medical, care and disadvantage indicators about children, Absolute Education recommends schools complete a DPIA, and provides a DPIA template with its part already filled in.

7. Deletion, audit, liability and term

Return and deletion

1. On request, and when a trial or subscription ends, Absolute Education will provide the School with an export of its School Data in Excel or CSV format.
2. Absolute Education will permanently delete School Data from live systems within 30 days of the end of the trial or subscription, unless the School asks for an export first or the law requires retention.
3. Backups containing School Data are overwritten on a rolling cycle and will be fully purged within 30 days of deletion from live systems.
4. Absolute Education will confirm deletion in writing on request.
5. During the subscription, the School controls how long pupil records are kept and can delete pupils or archive leavers through the Service.

Audit

6. Absolute Education will answer the School’s reasonable written data protection questionnaires and provide its current Cyber Essentials certificate on request.
7. Where a questionnaire is not sufficient, the School (or an auditor bound by confidentiality) may carry out an audit once a year on 30 days’ notice, during working hours, at its own cost, unless a breach makes an earlier audit necessary.

Liability

8. Each party is liable for its own breaches of Data Protection Law. Liability under this agreement is subject to the limits in the Terms of Service, except that nothing limits liability that cannot be limited by law.

Term and law

9. This agreement starts when the School creates an account (including during a trial) and lasts as long as Absolute Education holds School Data.
10. If this agreement conflicts with the Terms of Service, this agreement prevails.
11. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1 – Details of processing

Schedule 2 – Approved sub-processors

Wonde Ltd acts under its own agreement with the School and is not a sub-processor of Absolute Education. Customer support is provided directly by Absolute Education staff by email, with no third-party support tool.

Schedule 3 – Security measures

1. Certification: Cyber Essentials certificate, renewed annually.
2. Encryption: TLS for all data in transit; servers, storage and backups encrypted at rest by our hosting provider (DigitalOcean).
3. Access control: role-based access within each school, managed by the School’s admin users; each school sees only its own data.
4. Staff access: limited to named Absolute Education staff, with unique accounts, strong passwords and multi-factor authentication.
5. Resilience: hourly, daily and weekly backups held in the UK, with restoration tested monthly.
6. Monitoring: server and application logging, prompt security patching, and regular review of access.
7. People: confidentiality obligations and annual data protection training for all staff.

Signatures

Shown completed for an example school. When you log in, this agreement shows your school’s details, and a school admin can accept it online from School Settings.